Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.8, published 27 October 2026.

Which products and versions are affected?

Facebook Hydra 1.3.6 through 1.3.7, 1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2; hydra-core (PyPI) >= 1.3.6, < 1.3.8, ECOSYSTEM:introduced=1.3.6,fixed=1.3.8.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Facebook Hydra or hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Hydra legacy target blacklist permits unsafe PyYAML loading

Q: Is there a fix for This vulnerability?

Yes. hydra-core (PyPI): upgrade to 1.3.8 or later. Until then: Do not pass untrusted configuration to instantiate() or call(). For Hydra 1.4, supply a narrow execution whitelist from trusted Python code and do not allow untrusted configuration to select its own execution policy or opt out of checks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Facebook Hydra or hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.8 · Published 2026-10-27

Hydra is a framework for configuring complex applications through code instantiation. When applications pass untrusted configuration to Hydra's legacy instantiation path, an attacker can use unsafe PyYAML loading functions to execute arbitrary Python code in the application process. This could allow a malicious model downloaded from a repository like Hugging Face to run code when the victim loads it.

Technologies: Facebook Hydra, hydra-core (PyPI). Vendors: Facebook, PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.8, published 27 October 2026.
Which products and versions are affected?: Facebook Hydra 1.3.6 through 1.3.7, 1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2; hydra-core (PyPI) >= 1.3.6, < 1.3.8, ECOSYSTEM:introduced=1.3.6,fixed=1.3.8.
Is there a fix for This vulnerability?: Yes. hydra-core (PyPI): upgrade to 1.3.8 or later. Until then: Do not pass untrusted configuration to instantiate() or call(). For Hydra 1.4, supply a narrow execution whitelist from trusted Python code and do not allow untrusted configuration to select its own execution policy or opt out of checks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Facebook Hydra or hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hydra-core (PyPI): upgrade to 1.3.8 or later
```
pip install "hydra-core>=1.3.8"
```

Do not pass untrusted configuration to instantiate() or call(). For Hydra 1.4, supply a narrow execution whitelist from trusted Python code and do not allow untrusted configuration to select its own execution policy or opt out of checks.

Technical details

The legacy blacklist in Hydra 1.3 and the deprecated 1.4 path omits PyYAML's unsafe loading surfaces, allowing instantiation of yaml.unsafe_load and similar functions. An attacker who controls the target callable and configuration can construct a YAML stream with Python object-construction tags that executes code at application privilege level. This is a gap in the defense-in-depth blacklist mechanism; Hydra 1.4's explicit whitelist path is not affected.

Affected products

Facebook Hydra 1.3.6 through 1.3.7, 1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2

Timeline

2026-10-27: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.